logstash_conf

input {
  beats {
    # The port to listen on for filebeat connections.
    port => 5044
    # The IP address to listen for filebeat connections.
    host => "0.0.0.0"
  }
}
filter {
   if "jetty" in [service] {
     grok {
       match => { "message" => ["%{MONTH:month} %{MONTHDAY:day}, %{YEAR:year} %{TIME:time} %{WORD:day_period} %{NOTSPACE:[system][jetty][class]} %{WORD:[system][jetty][method]}\n%{GREEDYMULTILINE:multiline}",
                               "%{WORD:severity} in thread \"%{THREADNAME:threadName}\" %{GREEDYDATA:[system][jetty][data]}",
                               "%{WORD:severity} in thread \"%{THREADNAME:threadName}\" %{NOTSPACE:[system][jetty][exceptionClass]}: %{GREEDYDATA:exceptionMessage}\n %{GREEDYMULTILINE:exceptionMultiline}"
                               ] }
       pattern_definitions => {
         "GREEDYMULTILINE" => "(.|\r|\n)*"
         "THREADNAME" => "[^\"]+"
       }
       remove_field => ["host"]
    }

    if "_grokparsefailure" in [tags] {
      drop {}
    }

    if [threadName] {
      if [exceptionMessage] {
        mutate {
          add_field => {
            "exeptMessage" => "%{exceptionMessage} %{exceptionMultiline}"
          }
          remove_field => ["exceptionMessage", "exceptionMultiline"]
        }

        mutate {
          add_field => ["data", "%{exeptMessage}"]
          remove_field => "exeptMessage"
        }

        mutate {
          gsub => [ "data", "\\n", "\n" ]
        }
        mutate {
         gsub => [ "data", "\\t", "\t" ]
        }
        mutate {
          rename => {"data" => "[system][jetty][data]"}
          convert => { "[system][jetty][data]" => "string" }
          remove_field => "data"
        }
      }
      mutate {
        gsub => [ "[system][jetty][data]", "^[A-Z]+, ", "" ]
      }
      mutate {
        rename => {"severity" => "[system][jetty][severity]"}
      }
    } else {

      mutate {
        add_field => {
          "timestamp_match" => "%{month} %{day} %{year} %{time} %{day_period}"
        }
        remove_field => [ "month", "day", "year", "time", "day_period" ]
      }

      mutate {
        convert => { "timestamp_match" => "string" }
      }

      date {
        match => [ "timestamp_match",
                   "MMM dd YYYY KK:mm:ss aa",
                   "MMM dd YYYY K:mm:ss aa" ]
        timezone => "UTC"
        target => "@timestamp"
        remove_field => ["timestamp_match"]
      }

      mutate {
        split => ["multiline", ":"]
        add_field => ["severity", "%{[multiline][0]}"]
      }
      if "WARN" in [severity] {
        mutate {
          update => { "severity" => "WARNING" }
        }
      }

      mutate {
        add_field => ["data", "%{multiline}"]
        remove_field => "multiline"
      }

      mutate {
        rename => {"severity" => "[system][jetty][severity]"}
      }

      mutate {
        gsub => [ "data", "\\n", "\n" ]
      }
      mutate {
        gsub => [ "data", "\\t", "\t" ]
      }

      mutate {
        rename => {"data" => "[system][jetty][data]"}
        convert => { "[system][jetty][data]" => "string" }
        remove_field => "data"
      }

#change severity to Exception of zip file closed in logfile

      if "java.lang.IllegalStateException, zip file closed" in [system][jetty][data] {
    mutate {
      update => { "[system][jetty][severity]" => "Exception" }
    }
      }

      if "JDBCConnectionException" in [system][jetty][data] {
        mutate {
          update => { "[system][jetty][severity]" => "Exception" }
        }
      }

      if "com.candorgrc.core.common.fileresources.DownloadServlet" in [system][jetty][class] {
    mutate {
      update => { "[system][jetty][severity]" => "WARNING" }
    }
      }

      if "Caused by: java.lang.IllegalStateException: Invalid for read:" in [message] {
        mutate {
      update => { "[system][jetty][severity]" => "WARNING" }
        }
      }

      if "at org.apache.shiro.web.session.HttpServletSession.getAttribute(HttpServletSession.java" in [message] {
        mutate {
          update => { "[system][jetty][severity]" => "WARNING" }
        }
      }

      if "Tenant Already Provisioned" in [message] {
        mutate {
         update => { "[system][jetty][severity]" => "WARNING" }
        }
      }

     if "org.apache.shiro.session.InvalidSessionException" in [message] {
        mutate {
         update => { "[system][jetty][severity]" => "WARNING" }
        }
     }
      mutate {
        gsub => [ "[system][jetty][data]", "^[A-Z]+, ", "" ]
      }
    }
    mutate {
      rename => {"threadName" => "[system][jetty][threadName]"}
    }
  }
}
output {
  if [service] in ["jetty", "msg-consumer", "consumer-reporter"] {
      stdout {
        codec => rubydebug
      }
  elasticsearch {
      hosts => ["172.16.99.5:9200"]
      manage_template => false
      index => "%{[@metadata][beat]}-log-%{[@metadata][version]}-%{+YYYY.MM.dd}"
      document_type => "%{[@metadata][type]}"
    }
  }
}